QNAP Fixes High-Severity Flaws: NetBak Replicator RCE and SQL Injection in Qsync Central

QNAP has issued a security advisory addressing multiple flaws in NetBak Replicator and Qsync Central, including the highest-risk CVE-2025-57714, a code-execution risk in NetBak Replicator that could let a local attacker run unauthorized code by exploiting unquoted file paths. The most serious NetBak Replicator issue has been patched in version 4.5.15.0807 and later, and users are urged to update immediately.

Five CVEs affect Qsync Central, with CVE-2025-44012, CVE-2025-47210, CVE-2025-52867, CVE-2025-53595 and CVE-2025-54153; the latter two are SQL injection vulnerabilities rated at CVSS 8.6 and could allow remote attackers with user access to execute unauthorized code or commands. QNAP has fixed all these vulnerabilities in Qsync Central version 5.0.0.2 (released 31 July 2025) and later, according to QNAP’s security advisory qsa-25-35.

To apply the patches, the company suggests updating via App Center after logging in as an administrator, and to mitigate exposure, administrators should limit local account access and avoid exposing NAS management ports to the internet.